Hi airsun, thanks for your reply!
I stop the Syslog, made the change to: "D:\Syslog\%IPAdd4\%DateY4\%DateM2\%IPAdd4.txt" and has no success.
Kiwi still merging the ip address.
Any other ideas?
Update: I tried "D:\Syslog\%IPAdd4\%DateY4\%DateM2\Log.txt" and has no success too...